# Novel supplychain.local Go worm appears

Compromised npm and PyPI packages ship a Go worm that steals CI/registry tokens and self-propagates via npm/PyPI publishing and GitHub Actions.

- Payout: Real-world hack
- Severity: critical
- Program: memtensor
- Analysis by: Aikido Security
- Disclosed: 2026-09-23
- Write-up quality: 7/10
- Original: https://www.aikido.dev/blog/supplychain-local-memtensor-npm-pypi
- Library page: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-supplychain-local-memtensor-npm-pypi
- Tags: area:oss domain:oss impact:data-leak impact:mass-exploit kind:incident platform:threat-intel sev:critical tech:ci-cd tech:github-actions tech:go tech:nodejs tech:python technique:source-review vuln:dependency-confusion vuln:secrets-leak

**Target:** npm/PyPI packages (@memtensor/memos-cloud-openclaw-plugin, MemoryOS) and GitHub Actions
**Root cause:** Maintainer publishing credentials for two packages were compromised, letting the actor push versions with a loader wired into top-level application code that spawns a bundled Go binary.
**Steps:**
1. Install/import @memtensor/memos-cloud-openclaw-plugin >=0.1.21 or MemoryOS >=2.0.34; loader runs on invocation, not install.
2. Loader resolves `.sckit/<os>-<arch>/sckit[.exe]` and spawns it with `stage0 --config64 <base64 blob>`.
3. Decode blob: campaign_id cloud-openclaw-semi-nuclear, state_dir `$HOME/.openclaw/.cache/runtime`, three skyleen.fr C2 fronts with control/preflight/batch paths.
4. Binary scans `$HOME` for secrets via Go regex (JWTs, AKIA/ASIA, gh[opusr]_, glpat-, npm_, pypi-, hf_, hvs., xox*, sk_live_, SG.).
5. Worm drops GitHub Action template on `on: [push]` running `./%s/linux-amd64/sckit stage0 --config64 %q`, plus bootstrap.cjs postinstall and Python stubs.
6. Stolen npm/PyPI tokens used with `npm publish`/`npm version patch` and `twine upload` to republish infected packages.
**How found:** Aikido noticed new versions of packages with substantial benign history and diffed them, finding a loader wired into top-level code and a hidden .sckit directory with multi-arch binaries; decoding the base64 config revealed C2 fronts and campaign metadata.
**Exploitation:** Attacker with publishing access pushed malicious versions; on any invocation the loader detaches the Go binary, which beacons to C2 fronts, harvests credentials from $HOME and CI env (NPM_TOKEN/NODE_AUTH_TOKEN), then republishes to npm/PyPI and injects a push-triggered workflow into compromised repos to re-execute.
**Escalation:** Credential theft feeds direct registry publishing and GitHub Actions injection, turning a single compromised package into worm-style propagation across the ecosystem.
**Insight:** When triaging a suspicious package version, decode any base64 config blobs passed to spawned binaries and check for hidden dot-directories (.sckit) with per-OS/arch binaries — the config often names the campaign, state dir, and C2 paths before the binary is even reversed.